Forminator did not check its own form-management permission when WordPress XML-RPC wp.newPost / wp.editPost calls targeted Forminator forms, quizzes or polls, and it accepted submissions to any form that was not a draft. A Contributor could therefore create a pending registration form over XML-RPC that grants the Administrator role, then submit it to obtain an administrator account. The patch blocks those XML-RPC calls for users without Forminator access and only accepts submissions to published forms (and to lead forms linked from a published quiz), as upstream 1.56.0.1 does.
This vulnerability affects the following application versions:
- Forminator Forms 1.13.3
- Forminator Forms 1.13.4
- Forminator Forms 1.13.5
- Forminator Forms 1.14.6
- Forminator Forms 1.14.7
- Forminator Forms 1.14.8
- Forminator Forms 1.14.8.1
- Forminator Forms 1.14.9
- Forminator Forms 1.14.10.1
- Forminator Forms 1.14.11
- Forminator Forms 1.14.12
- Forminator Forms 1.14.12.1
- Forminator Forms 1.15.0.1
- Forminator Forms 1.15.2
- Forminator Forms 1.15.4
- Forminator Forms 1.15.7
- Forminator Forms 1.15.9
- Forminator Forms 1.15.11
- Forminator Forms 1.15.12
- Forminator Forms 1.15.13
- Forminator Forms 1.15.14
- Forminator Forms 1.16.2
- Forminator Forms 1.17.1
- Forminator Forms 1.17.2
- Forminator Forms 1.18.1
- Forminator Forms 1.18.2
- Forminator Forms 1.19.0
- Forminator Forms 1.20.1
- Forminator Forms 1.21.0
- Forminator Forms 1.22.1
- Forminator Forms 1.23.3
- Forminator Forms 1.24.1
- Forminator Forms 1.24.4
- Forminator Forms 1.24.5
- Forminator Forms 1.24.6
- Forminator Forms 1.25.0
- Forminator Forms 1.25.1
- Forminator Forms 1.25.2
- Forminator Forms 1.26.0
- Forminator Forms 1.27.0
- Forminator Forms 1.28.0
- Forminator Forms 1.28.1
- Forminator Forms 1.29.0
- Forminator Forms 1.29.2
- Forminator Forms 1.29.3
- Forminator Forms 1.30.2
- Forminator Forms 1.31.0
- Forminator Forms 1.32.0
- Forminator Forms 1.33.0
- Forminator Forms 1.34.0
- Forminator Forms 1.34.1
- Forminator Forms 1.35.0
- Forminator Forms 1.35.1
- Forminator Forms 1.36.0
- Forminator Forms 1.36.1
- Forminator Forms 1.36.2
- Forminator Forms 1.36.3
- Forminator Forms 1.37.1
- Forminator Forms 1.38.1
- Forminator Forms 1.38.2
- Forminator Forms 1.38.3
- Forminator Forms 1.39.0
- Forminator Forms 1.39.1
- Forminator Forms 1.39.2
- Forminator Forms 1.39.3
- Forminator Forms 1.40.0
- Forminator Forms 1.41.1
- Forminator Forms 1.41.2
- Forminator Forms 1.42.0
- Forminator Forms 1.42.1
- Forminator Forms 1.42.2
- Forminator Forms 1.43.0
- Forminator Forms 1.43.1
- Forminator Forms 1.44
- Forminator Forms 1.44.1
- Forminator Forms 1.44.2
- Forminator Forms 1.44.3
- Forminator Forms 1.45
- Forminator Forms 1.45.1
- Forminator Forms 1.46.1
- Forminator Forms 1.46.2
- Forminator Forms 1.47
- Forminator Forms 1.48.2
- Forminator Forms 1.48.3
- Forminator Forms 1.49.0
- Forminator Forms 1.49.2
- Forminator Forms 1.50.1
- Forminator Forms 1.50.3
- Forminator Forms 1.51
- Forminator Forms 1.51.1
- Forminator Forms 1.52
- Forminator Forms 1.52.1
- Forminator Forms 1.52.2
- Forminator Forms 1.53.0
- Forminator Forms 1.53.0.1
- Forminator Forms 1.53.1
- Forminator Forms 1.53.2
- Forminator Forms 1.54
- Forminator Forms 1.54.0
- Forminator Forms 1.55.0
- Forminator Forms 1.55.0.1
- Forminator Forms 1.55.0.2
- Forminator Forms 1.55.1
- Forminator Forms 1.56.0